Risk Assessment —

Sears: Come see the softer side of spyware

When you join an online "community," are you joining so that you can interact …

Sears and Kmart are places you might go when you need a new air conditioner filter or a lawnmower; they're not generally thought of as havens for spyware. But that's what the two stores have become, at least online, where their web sites were found to be installing software to track users' every online move—all without their knowledge. Security researchers are now hammering Sears (the owner of both Sears.com and Kmart.com) for the move, despite Sears' claims that users were notified adequately beforehand.

The story goes like this: late last year, Sears.com and Kmart.com began asking users if they wanted to participate in a "community" online (presumably a community made up of Sears and Kmart aficionados). In late December, security researcher Benjamin Googins at Computer Associates noticed, however, that the "community" actually installed software from comScore, a market research firm, in order to track the web activities of the sites' visitors.

Googins stated on his company's blog that Sears had installed spyware which transmitted everything—"including banking logins, email, and all other forms of Internet usage"—to comScore for analysis. This was all allegedly done with no notice that anything was being installed, and it ran contrary to documentation about the community that said any data collected would stay within Sears' hands at all times.

But wait, there's more! In an update to his original post, Googins noted that Sears actually offers a slightly different privacy policy—via the same URL—to compromised computers versus those that have yet to install the software. "If you access that URL with a machine compromised by the Sears proxy software, you will get the policy with direct language (like 'monitors all Internet behavior'). If you access the policy using an uncompromised system, you will get the toned-down version (like 'provide superior service')," he wrote.

Surprisingly, Sears VP Rob Harles responded to Googins' original post, stating that the company "goes to great lengths to describe the tracking aspect." He claims that "clear notice" is provided to users multiple times throughout the sign-up process. The "community" continued on.

Now, spyware researcher Ben Edelman has taken a look at the situation, and he agrees with Googins' assessment. Edelman heavily scrutinized all documentation that came with signing up for the community and found a few mentions of tracking software buried deep within the tangled legalese (for example, one mention was on page 10 of a 54-page license document). This, he says, goes against regulations by the Federal Trade Commission that require clear, unavoidable disclosure and "express consent" from the user before installing such software.

The two vague disclosures that Edelman found both fail to meet the FTC's standards, he says, and he argues that Harles couldn't possibly be more incorrect in his assertions that Sears goes to great lengths—or any lengths at all—to inform users of what's going on.

The whole incident is reminiscent of another recent privacy blunder by Facebook, where its Beacon application tracked user activity elsewhere on the web and reported it back to the site for the world to see. The difference is that Facebook reacted relatively quickly to the community outrage (that is, the real, actual Facebook community, and not a nebulous term to describe being tracked by a retailer) and made significant changes to how Beacon interacted with the users it was tracking. The situation is still not perfect—the tool still tracks users' activity even if they choose not to have it displayed—but it puts Facebook light-years ahead of where Sears is right now. As of today, Sears' online community—complete with very detailed comScore tracking software—is still available online.

Jacqui Cheng
Jacqui is an Editor at Large at Ars Technica, where she has spent the last eight years writing about Apple culture, gadgets, social networking, privacy, and more. Emailjacqui@arstechnica.com//Twitter@eJacqui